context-extraction
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external translation strings sourced from Crowdin projects. Maliciously crafted strings within these projects could potentially influence the AI's generated output for the context fields.
- Ingestion points: The
crowdin-context.jsonlfile, which is downloaded directly from the Crowdin platform. - Boundary markers: The instructions explicitly restrict the agent to editing only the
ai_contextfield and provide a detailed validity checklist to ensure JSON integrity. - Capability inventory: The skill performs local file reading (JSONL and source code), file writing (JSONL), and shell command execution via the
crowdinCLI for data synchronization. - Sanitization: Clear guidelines are provided for JSON character escaping and structure verification before saving changes.
- [COMMAND_EXECUTION]: The skill utilizes the
crowdinCLI tool to perform several operations, including checking status, downloading translation context, and uploading modified data. These commands represent the core functionality of the skill and involve network communication with the Crowdin service.
Audit Metadata